This invention relates generally to security software, including antivirus and anti-spam software, and in particular to detecting malicious software and blocking unwanted visual displays using feedback from a user.
There are classes of malicious and/or annoying software programs (referred to herein collectively as malicious software or malicious code) that do not run silently. Rather, these programs cause the unwanted display of advertising pop-ups or other annoying user interface elements on the user's desktop. Examples of this type of malicious software include some adware programs and some downloaders. Traditional security software may fail to detect these types of malicious software for various reasons. For example, there has been a recent of server-size polymorphism, where an attacker polymorphs each threat on the server so each user receives a different executable threat. As a result, many threats and annoyances caused by malicious software may be missed by traditional antivirus and anti-spam detection methods used by security software.
When security software fails to detect and block malicious software that is causing the annoying or unwanted display of pop-ups, the security software is made to look particularly inept. This is because the failure of the security software is manifested in a visible display that is presented directly to the user. The experience may be particularly frustrating for users, since the security software is failing to catch and prevent pop-ups from malicious software, even though the existence of the malicious software is obvious to the user because the pop-ups are right in the user's face. This failure of the security software may be a significant driver causing users to change their security software.
Accordingly, what is needed is a mechanism to improve the detection and prevention of malicious software that generates unwanted pop-ups or other unwanted visible elements on a user's desktop.